CVE-2026-89058: RESTEasy CorsFilter CSRF Vulnerability

CVE-2026-89058 Overview

CVE-2026-89058 is a permissive Cross-Origin Resource Sharing (CORS) misconfiguration flaw in RESTEasy's CorsFilter. When the filter is configured to allow all origins using the wildcard "*", it reflects the request's Origin header back in the Access-Control-Allow-Origin response header while simultaneously sending Access-Control-Allow-Credentials: true. This combination violates the CORS specification and enables malicious websites to issue credentialed cross-origin requests against a victim's authenticated session. The attacker's page can then read authenticated responses, resulting in a loss of confidentiality. The weakness is tracked under CWE-942: Permissive Cross-domain Policy with Untrusted Domains.

Critical Impact
A remote attacker who convinces an authenticated user to visit a malicious page can read cross-origin responses from RESTEasy-backed APIs, exposing session-protected data.

Affected Products

RESTEasy (JBoss RESTEasy JAX-RS implementation)
Red Hat products bundling vulnerable RESTEasy versions (see Red Hat CVE-2026-89058)
Applications using org.jboss.resteasy.plugins.interceptors.CorsFilter with wildcard origins

Discovery Timeline

2026-09-18 - CVE-2026-89058 published to the National Vulnerability Database
2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-89058

Vulnerability Analysis

The flaw lives in the CorsFilter class shipped with RESTEasy. When a developer adds "*" to the allowed origins list, the filter does not treat this as a strict wildcard. Instead, it echoes the incoming Origin request header verbatim in the Access-Control-Allow-Origin response header and pairs it with Access-Control-Allow-Credentials: true. Browsers accept this pairing because the response looks origin-specific rather than wildcarded. As a result, a page hosted on any attacker-controlled origin can issue fetch or XMLHttpRequest calls with credentials: 'include', and the browser will attach the victim's session cookies or Authorization headers. The attacker's JavaScript then reads the response body, extracting authenticated data.

Root Cause

The root cause is a permissive cross-domain policy combined with credential reflection. Historically, RESTEasy also enabled credentials by default, compounding the risk. The upstream fix disables credentials by default and warns operators when a wildcard origin is combined with credentials.

Attack Vector

Exploitation requires a network path to the target API and user interaction: the victim must be authenticated to the RESTEasy application and must load an attacker-controlled page in the same browser session. No privileges on the target application are required beyond an active session for the victim.

java

// Patch excerpt: LogMessages.java warns when wildcard origin is combined with credentials
@LogMessage(level = Level.WARN)
@Message(id = 2410, value = "The CORS filter allows all origins (\"*\") and credentials. Credentials are not "
        + "supported with a wildcard origin, so Access-Control-Allow-Credentials will not be sent. Configure an "
        + "explicit list of allowed origins if credentials are required.")
void corsCredentialsIgnoredForWildcardOrigin();
// Source: https://github.com/resteasy/resteasy/commit/efeb2b7

Detection Methods for CVE-2026-89058

Indicators of Compromise

HTTP responses from RESTEasy endpoints containing both Access-Control-Allow-Credentials: true and an Access-Control-Allow-Origin value that mirrors an arbitrary request Origin.
Preflight OPTIONS requests from unexpected external origins referencing authenticated API paths.
Application logs showing successful credentialed API calls with Referer or Origin headers pointing to unaffiliated third-party sites.

Detection Strategies

Audit application code and configuration for calls to CorsFilter.getAllowedOrigins().add("*") combined with setAllowCredentials(true).
Run active scans that send varied Origin headers to authenticated endpoints and inspect the Access-Control-Allow-Origin reflection behavior.
Correlate web access logs to identify cross-origin request bursts targeting session-protected resources.

Monitoring Recommendations

Ingest reverse proxy and application logs into a centralized analytics platform and alert on anomalous Origin header distributions per endpoint.
Monitor for the new patch warning message RESTEASY002410 indicating a misconfigured wildcard origin.
Track authentication events for signs of data access originating from suspicious referrers or geographies.

How to Mitigate CVE-2026-89058

Immediate Actions Required

Inventory all RESTEasy deployments and identify any CorsFilter configuration using "*" as an allowed origin.
Replace wildcard origins with an explicit allowlist of trusted domains that require credentialed access.
Upgrade to the patched RESTEasy release that disables credentials by default and rejects the wildcard-plus-credentials combination.

Patch Information

The fix is delivered in RESTEasy upstream commit efeb2b7, tracked as RESTEASY-3796 and disclosed in GHSA-972r-f3fv-whm3. The patch disables Access-Control-Allow-Credentials by default, requires explicit opt-in via CorsFilter.setAllowCredentials(true), and logs a warning if credentials are combined with a wildcard origin. Refer to the Red Hat advisory and Red Hat Bug #2519775 for downstream package versions.

Workarounds

Remove "*" from CorsFilter.getAllowedOrigins() and register only the specific origins that require CORS access.
Call filter.setAllowCredentials(false) on endpoints that do not require credentialed cross-origin access.
Terminate CORS handling at an upstream reverse proxy or API gateway that enforces a strict origin allowlist and rejects unauthorized preflight requests.

bash

# Configuration example: explicit allowlist replacing wildcard origin
# Java snippet applied in the JAX-RS Application class
# CorsFilter filter = new CorsFilter();
# filter.getAllowedOrigins().add("https://app.example.com");
# filter.getAllowedOrigins().add("https://admin.example.com");
# filter.setAllowCredentials(true); // only with explicit origins, never with "*"